🧰 Elastic

The items that name it 7

• 0sec-labs/0
  repo2026-08-19

  Integration via plugins/MCP

• MacSync Stealer: How a Google Search for Claude Led to a macOS Infostealer
  writeup2026-08-17

  Source of telemetry used to pivot off the curl command and reconstruct the loader request.

• Talaria
  repo2026-07-31

  consumes JSON telemetry output from Talaria

• n8n Cybersecurity Workflows
  repo2026-05-06

  SIEM/log storage and querying

• Linux Capabilities Revisited
  writeup2025-05-16It is written here as Elastic (detection rule).

  SIEM/EDR rule 'Process Capability Set via setcap Utility' that detects use of the setcap utility to set capabilities on a process

• Today I Learned - setfacl
  writeup2024-12-17

  provides a detection rule for abuse of the setfacl command via process monitoring

• chainguard-dev/malcontent
  repo

  Third-party YARA rule contributor; also Elastic's agent has historically flagged malcontent as malicious due to shared YARA string detection (referenced issue #78)